subroutine agent
The 1 command under subroutine agent, each with its arguments and options.
subroutine agent [OPTIONS] COMMAND [ARGS]...
Set an AI agent up as a principal of its own.
subroutine agent create
subroutine agent create [OPTIONS] [name]
Give an agent an identity of its own, and say how to hand it over.
Examples:
subroutine agent create claude --profile worker --project WEB
subroutine agent create sam --profile collaborator --project SR --write SUBSAMPLE
subroutine agent create reporter --profile observer --expires now+30d
subroutine agent create subsample --workspace projects --project SUBSAMPLE
This is 'user create', 'user add' and 'token create' as one act, because they are one decision: an account with no membership authenticates and can do nothing, which reads as a broken token rather than as a missing role.
Handing the token over is half the work. An agent that can run shell commands reaches this instance two ways — through the tools its editor wired up, and by running 'subroutine' itself — and those resolve credentials separately. Give the token only to the editor and the agent is itself over the tools and *you* in its shell, which is worse than plainly acting as you: half its work is correctly attributed, so a spot check finds its name and concludes the setup worked.
'--store' covers both halves and is the only thing that covers the second. It records the credential beside yours rather than in place of it, and 'subroutine' then acts as the agent in a process the agent started and as you everywhere else — including in 'git' hooks, which are the highest-volume writer here and the one no editor setting reaches.
'--profile' says what the agent is *for*, and expands into the flags below it. 'worker' owns one project; 'collaborator' reads several and writes one of them; 'observer' reports and changes nothing. A combination that means two things at once is refused rather than resolved — '--profile observer --write WEB' is not a narrower observer.
The credential is checked by being presented, not by being described: what it can actually do is read back from the instance before this command claims anything.
Arguments
name(str): What to call the agent, e.g. 'claude'.
Options
--project(str, repeatable): Restrict it to this project and everything under it. Repeatable.--write(str, repeatable): Only let it change things in this project. Must be one it can reach.--workspace(str): Which workspace it works in. Pins the credential to it.--scope(str, repeatable): Narrow it to these permissions. Repeatable.--profile(str): What the credential is for. worker: owns one project and everything under it; collaborator: reads related work for context, writes only its own project; observer: reports on work and changes nothing; colleague: another person, working in one workspace as they would in their own--expires(str): Stop it working after this day, e.g. 2026-09-01 or now+30d.--title(str): What this credential is for.--store(flag): Record it on this machine as this connection's agent.